PHP2Shell: a patch-verification and hunting plan for the four days before disclosure

How to verify that a PHP2Shell patch actually removed the vulnerable process, and why the hunting window starts four days before disclosure.